Fake Google and Cloudflare verification pages spread multiple malware families
We uncovered ClickFix attacks using fake Google and Cloudflare pages to deliver everything from infostealers to a newly discovered malware loader.
Search Intelligence
Browser-Only Ransomware: From LLM Hallucinations to a Practical Attack Technique
Research by: Alexey Bukhteyev Key Takeaways Introduction Over the past several years, large language models have reshaped software development, and malware development has followed the same path.
How ransomware syndicates weaponize corporate-style organization
From outsourced labor to tiered pricing models, an inside look at how today's top ransomware threats operate less like rogue hackers and more like Fortune 500 companies. The post How ransomware syndic
119 Edge extensions promised useful tools, instead downloaded malware
Microsoft has removed over 100 Edge extensions that were delivering malware hidden in images.
The Gentlemen are knocking: сustom backdoors and evolving tactics
Kaspersky researchers analyze incidents related to The Gentlemen RaaS group, disclose their tools and TTPs, and find a new ransomware variant.
Malware steals Chrome session cookies to take over your accounts
A phishing campaign installs a malicious Chrome extension to hijack browser sessions and compromise Windows devices.
In a first, a court takedown goes after two cybercrime tools at once
Microsoft, with law enforcement and industry partners, disrupted more than 200 command and control servers for Amadey and StealC, often used in conjunction. The post In a first, a court takedown goes
Embedding Forbidden Text in Spyware to Discourage AI Analysis
At least one malware developer is adding text about nuclear and biological weapons to their spyware, in an effort to stop automatic AI analysis. Details : The _index.js payload begins with a large Jav
"Total access to all your devices." Sextortion scammers strike again
They say they have videos, malware, and total control of your devices. Here's how to read a sextortion email like a security researcher instead of a victim.
Inside the dark web: Stolen identities for 95¢, malware, and scams-for-hire
We spent 48 hours exploring the dark web and found stolen identities, malware, scams, and a thriving cybercrime economy.
One intrusion, two cyberattackers: Uncovering parallel threat activity
Ransomware case reveals two parallel threat actors, blending tactics and evasion—showing why isolated signals can often miss modern, overlapping cyberattacks. The post One intrusion, two cyberattacker
Nearly 15,000 infected websites cleaned in SocGholish crackdown
Thousands of everyday websites were cleaned as part of a global operation targeting the malware network behind fake browser update scams.
Authorities disrupt Evil Corp’s SocGholish botnet
Cybersecurity firms, researchers and officials took down 106 servers and remediated nearly 15,000 sites that were infected with the malware. The post Authorities disrupt Evil Corp’s SocGholish botnet
Retro gaming fans are the new target for fake GitHub malware
Retro gaming fans should be careful with GitHub projects that claim to be tools or plugins for their consoles. We looked at one example aimed at PlayStation Vita owners.
Embedding Forbidden Text in Spyware to Discourage AI Analysis
At least one malware developer is adding text about nuclear and biological weapons to their spyware, in an effort to stop automatic AI analysis. Details : The _index.js payload begins with a large Jav
Roblox developers are losing entire games to malware attacks
Attackers are using fake job offers and malware to steal accounts, Robux, and Roblox games from the developers who build them.
Rokarolla Android malware can take over your phone and steal banking logins
Researchers have uncovered an Android banking Trojan that targets more than 200 banking and cryptocurrency apps and can take over infected devices.
Malwarebytes earns AV-TEST Top Product award, aces other third-party tests
Malwarebytes got top marks in independent tests against malware, phishing, and other online threats.
Inside a malicious infrastructure delivering EtherRAT, phishing pages, and malicious software
We found EtherRAT malware being distributed by a website with a strange homepage. Following the trail, we discovered a vast network of malicious infrastructures, distributing malware, malicious docume
Conti ransomware group member pleads guilty, faces up to 20 years in prison
Oleksii Lytvynenko, a 44-year-old Ukrainian national, admitted to joining the prolific cybercrime group in 2021. Officials said he engaged in cybercrime up until his arrest in Ireland in 2023. The pos